AI governance is moving higher on the regulatory agenda
The European Supervisory Authorities (EBA, European Insurance and Occupational Pensions Authority (EIOPA) & European Securities and Markets Authority (ESMA)) have called for stronger governance and a consistent supervisory approach to address ICT and cybersecurity risks associated with frontier AI models in the financial sector. As AI adoption accelerates, operational resilience, risk management, and compliance must evolve alongside it, particularly under frameworks such as DORA. The message is clear: innovation and resilience must go hand in hand.
The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) published a statement calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigate the ICT risks stemming from frontier AI models.
The statement takes into account existing regulatory requirements, the European Commission’s Action Plan on Cybersecurity and Artificial Intelligence, as well as recent publications by the European Systemic Risk Board (ESRB), the European Union Agency for Cybersecurity (ENISA), the Single Supervisory Mechanism (SSM) and other competent authorities.
The ESAs outline measures to help financial entities strengthen their operational resilience against cyber risks linked to frontier AI models. Particular emphasis is placed on the prevention, detection and management of these risks.
The statement underlines that financial entities should have robust governance and risk management frameworks in place to support the effective management and mitigation of cyber risks associated with frontier AI models. It also updates on ongoing and planned DORA oversight activities for critical ICT third-party providers (CTPPs) to address this risk.
The ESAs encourage both financial entities and competent authorities to use the statement as a basis for supervisory dialogue, taking into account existing supervisory expectations. Such an approach would help ensuring that the EU financial system remains resilient against the risks driven by frontier AI technologies.
